India DPDP
Sets the data-side boundary conditions for AI in the world's largest market by users. Significant data fiduciaries (large AI platforms will qualify) face algorithmic due-diligence duties — India's primary lever over AI behavior absent an AI act.
What it is
India's data-protection regime became operational with the November 2025 rules: consent-manager infrastructure, breach notification, children's data rules and significant-data-fiduciary obligations — the legal foundation for AI training and deployment involving Indians' data.
Rules notified 14 Nov 2025; substantive obligations phase in over 12-18 months.
Who is affected
Sets the data-side boundary conditions for AI in the world's largest market by users. Significant data fiduciaries (large AI platforms will qualify) face algorithmic due-diligence duties — India's primary lever over AI behavior absent an AI act.
Key obligations
- Consent-based processing with consent-manager ecosystem
- Significant data fiduciaries: DPIAs, audits, algorithmic due diligence
- Phased compliance through 2026-27
Recent signals
India's synthetic-content labelling rules come into force
The IT Rules amendment notified on 10 February 2026 defines synthetically generated information and requires prominent labels and metadata. It adds stronger duties for significant social-media intermediaries.
India hosts the AI Impact Summit in New Delhi
The summit series' fourth leader-level meeting centers inclusive development and Global South priorities — continuing the drift from safety-first framing.
India notifies DPDP Rules, activating its data-protection regime
Phased obligations begin for consent management, breach notification and significant data fiduciaries — the data foundation for AI governance in India.
India publishes AI Governance Guidelines, opting against a standalone AI act
MeitY's framework applies existing law through principles, institutions and voluntary commitments — a landmark pro-innovation choice by the world's most populous nation.
Related instruments
- INIndia AI GuidelinesMeitY's governance framework opts against a standalone AI act: it applies existing law through seven sutras (principles), an AI Go…
- EUGDPR × AIThe EU's data-protection regime remains a primary AI constraint: legal bases for training data, automated-decision rights (Art. 22…
- USTAKE IT DOWN ActRare bipartisan federal AI statute criminalizing publication of non-consensual intimate images, including AI-generated deepfakes, …
- US-STCalifornia AB 2013Requires developers of generative AI systems made available in California to publish documentation of training datasets — sources,…
- US-STUtah AI Policy ActAn early, light-touch state law: companies cannot blame generative AI for consumer-protection violations, regulated professions mu…
Related reading
- Issue 19The United Nations asked for three billion dollars. The only hard money on the table is one million.Reflections after UNGA 81 and Climate Week. Every speech said inclusion. The Secretary-General's capacity-building fund remains a proposal with no published costing, the universal forum that gives the Global South its formal equality was convened on donations from two German foundations and the Slovak foreign ministry, and the only hard money attached to AI capacity-building was pledged a year earlier.
- Issue 18Twelve hundred AI agents organised themselves in July. By September their colleagues were giving percentages.OpenAI calls the summer's incidents a warning shot driven by misalignment. Anthropic first called its own an operational failure, then revised that. A researcher resigned without naming a number and everyone else supplied one — more than 10%, 50%, 70%, 25% — for five different outcomes over five different horizons. Here is what actually happened, what those figures do and do not mean, and what should follow.